Daily briefing · July 14, 2026
CRITICAL: Four CVEs Under Active Exploitation — SMA1000 SSRF, AD FS Privilege Escalation, and SharePoint Auth Bypass Lead the Charge
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — critical
July 14, 2026 delivers a CRITICAL verdict: four vulnerabilities confirmed in active exploitation by both CISA KEV and VulnCheck, spanning SonicWall SMA1000, Windows Active Directory Federation Services, and Microsoft SharePoint. With 990 new CVEs published today — 65 of them critical — and three CVSS 10.0 severities outside the KEV list still demanding immediate attention, defenders are facing one of the heavier single-day loads of the year.
Today’s brief
- 4 CVEs in active exploitation (CISA KEV + VulnCheck confirmed): SMA1000 SSRF, AD FS privilege escalation, SMA1000 code injection, and SharePoint auth bypass.
- Three additional CVSS 10.0 vulnerabilities published today: JWT algorithm bypass in Opcenter X, unauthenticated debug port in Rockwell 1715 EtherNet/IP, and auth bypass in JetBrains YouTrack.
- LockBit5 ransomware hits Brazilian public sector: Mato Grosso state health portal (saude.mt.gov.br) and two business services firms among freshly confirmed victims.
- 990 new CVEs today, 65 critical — patch prioritization is essential; focus immediately on KEV items and internet-exposed appliances.
Critical highlights
1
A CVSS 10.0 SSRF vulnerability in SonicWall SMA1000's Work Place interface allows an unauthenticated remote attacker to force the appliance to make arbitrary outbound requests — actively exploited in the wild per CISA KEV and VulnCheck. Internet-exposed SMA1000 appliances should be treated as critically compromised until patched.
2
An Active Directory Federation Services (AD FS) privilege escalation flaw — confirmed in active exploitation — allows an already-authorized attacker to elevate local privileges, making it a critical post-compromise multiplier in Windows environments running AD FS. Organizations relying on AD FS for identity federation should apply the patch immediately and audit privilege escalation telemetry.
3
A post-authentication code injection vulnerability in SonicWall SMA1000's Appliance Management Console (AMC) enables a remote admin-level attacker to execute arbitrary OS commands — confirmed actively exploited. Combined with CVE-2026-15409, this creates a dangerous chained attack path from unauthenticated SSRF to full OS-level compromise on SMA1000 devices.
4
CVE-2026-56164KEVMEDIUM 5.3affects Microsoft SharePoint Enterprise Server 2016 A missing authentication flaw in Microsoft SharePoint Enterprise Server 2016 allows unauthenticated network attackers to elevate privileges — actively exploited, despite its moderate CVSS 5.3 score. The low score belies the real danger: unauthenticated privilege escalation on SharePoint servers can pivot to lateral movement across enterprise environments.
5
A CVSS 10.0 JWT algorithm validation failure in Siemens Opcenter X allows any unauthenticated attacker to forge arbitrary tokens and impersonate any user, including administrators, granting full platform access. Although EPSS registers at 0% today, the trivial exploitability of JWT algorithm confusion attacks means weaponization could come quickly.
6
Rockwell Automation's 1715-AENTR EtherNet/IP Communications Module exposes an unauthenticated, network-accessible debug CLI with no privilege controls — CVSS 10.0. An attacker can read or delete files, halt tasks, modify memory, and alter I/O states, posing a direct threat to operational technology (OT) and industrial control environments.
7
JetBrains YouTrack is affected by a CVSS 10.0 authentication bypass via direct database access, enabling any attacker to obtain administrative access across multiple product versions. Development and project management platforms like YouTrack often hold sensitive source code references and internal communications — compromise carries significant supply chain risk.
8
Adobe ColdFusion 2023 is vulnerable to a path traversal flaw (CVSS 9.9) that allows arbitrary file system reads without user interaction, potentially exposing configuration files, credentials, and application secrets. ColdFusion servers are historically high-value targets and have seen repeated exploitation campaigns; this requires urgent patching.
9
A use-after-free in Windows VMSwitch (CVSS 9.9) allows an authorized attacker to elevate privileges over a network, making it a serious risk in virtualized Windows environments and Hyper-V deployments. Privilege escalation at the virtual switch layer can affect multiple guest VMs simultaneously, amplifying the blast radius.
10
DBI::SQL::Nano (Perl) versions 1.42 through before 1.651 evaluate SQL WHERE predicates with inverted comparison operators, meaning queries using <= and >= on text fields return incorrect results — with potential security implications for applications relying on DBI's built-in SQL engine for access control decisions. Developers using SQL::Nano as a fallback query engine should validate all comparison-based filtering logic and upgrade immediately.
Ransomware today
LockBit5 is the dominant threat in recent activity, with confirmed victims including santoinacio-rio.com.br and lbreng.com.br (both Business Services) and notably saude.mt.gov.br, the public health portal of Mato Grosso state, signaling continued pressure on Brazilian public sector infrastructure. Over the past 30 days, lockbit3, ransomhub, lockbit5, thegentlemen, 8base, and arcusmedia have been the six most active ransomware groups, all with significant focus on Brazilian targets.
santoinacio-rio.com.br BRlockbit5 · Business Services
lbreng.com.br BRlockbit5 · Business Services
saude.mt.gov.br BRlockbit5 · Public Sector
lockbit3 39ransomhub 35lockbit5 29thegentlemen 208base 20arcusmedia 19
Active groups & APTs
Several threat actors are currently flagged as active or updated in threat intelligence feeds: apt73, BlackShadow (Iran-linked), CoinbaseCartel, CopyKittens (Iran-linked), DragonForce, and AgainstTheWest. While no confirmed victim attributions are recorded for these groups in the current window, their active status warrants heightened monitoring, particularly for organizations in sectors historically targeted by Iranian APT clusters.
Brazil focus
Brazil is facing a concentrated ransomware wave: in recent weeks, LockBit5 claimed saude.mt.gov.br (Mato Grosso public health), santoinacio-rio.com.br, and lbreng.com.br; Deadlock targeted manufacturers Bombas Ideal and Werken Química Brasil S.A., as well as Direção Estacionamentos S.A.; Qilin claimed S.J. Louis; and Doommageddon targeted Francisco Imóveis. The breadth of sectors — public health, manufacturing, consumer services, and real estate — underscores that no vertical is out of scope for ransomware actors operating against Brazilian organizations.
santoinacio-rio.com.brlockbit5 · Business Services
saude.mt.gov.brlockbit5 · Public Sector
lbreng.com.brlockbit5 · Business Services
Bombas IdealDeadlock · Manufacturing
Werken Química Brasil S.A.Deadlock · Manufacturing
Direção Estacionamentos S.A.Deadlock · Consumer Services
S.J. Louisqilin
Francisco ImóveisDoommageddon · Consumer Services
Today’s recommendation: Immediately isolate and patch all internet-exposed SonicWall SMA1000 appliances (CVE-2026-15409 and CVE-2026-15410), apply Microsoft's AD FS and SharePoint patches (CVE-2026-56155 and CVE-2026-56164), and audit all Rockwell 1715-AENTR devices for unauthorized network access to their debug interfaces. For OT and ICS environments, network segmentation and access controls on the EtherNet/IP module should be validated as an immediate compensating control if patching cannot happen instantly.
With four actively exploited vulnerabilities and six additional critical-severity flaws published in a single day, now is the moment to validate whether your external attack surface and internal segmentation controls would contain — or silently allow — the threats described today.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →